Overview

overview

10

Static

static

1

RunScriptP...ed.lnk

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RunScriptProtected.zip

  • Size

    1KB

  • Sample

    241209-ynbl9straj

  • MD5

    890f4ca8250ea0b03c97042ac830d9a6

  • SHA1

    403c65ba0349799ef7ae2bd8378107c8103a7dc1

  • SHA256

    3421a6ad1ac42363c9ba102916d4f7d78e323cca2a7b8c4a4ecc752820e55bdc

  • SHA512

    30f8166cfa3cf5d7b08c55a164c37b268e89553c8d7a012be0f93724d34491049734c1dacd93b31c16ae428b3f9887342b0601189a4725eeb32db886cbeb90c0

Score
10/10
asyncratdefaultdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

alainlegrosper.ddns.net:6606

Mutex

sgXgvLmJ6SR3

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      RunScriptProtected.lnk

    • Size

      3KB

    • MD5

      7d7b89cb7fa6155b1e01334175ac1c5b

    • SHA1

      e777ad0ff4d4510ee345c06c34123b279b0b7ad6

    • SHA256

      7c8be71b3cfef2de7343bd48d20e33a6f2f94409d59c50f5ac3a5bbd703789fc

    • SHA512

      bd1ddf6149e7d51339ba326ad6fbd9d0b7eb4a2e6a0ca90cfd6a9024df0ee81e0cc2ac2e77e4c1b86146d4d06ccc24696c320d5ea166cf79d9062ff9d3b22038

    Score
    10/10
    asyncratdefaultdiscoveryexecutionrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks